[feat](maestro): serve the public hub app from an embedded bundle

The browser hub is a status/metadata reader for an instance, separate from the operator console and its owner cookies. Build it as its own Preact bundle at /hub/ outside the owner gate, embed it via //go:embed all:hub/dist (with a committed index placeholder so a clean checkout still builds), and apply a strict CSP because it shares the console origin. The Docker build stages the hub build alongside the console; dist assets remain ignored.

src/hub/tsconfig.node.json

@@ -0,0 +1,23 @@
+{
+  "compilerOptions": {
+    "tsBuildInfoFile": "./node_modules/.tmp/tsconfig.node.tsbuildinfo",
+    "target": "es2023",
+    "lib": ["ES2023"],
+    "types": ["node"],
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "module": "nodenext",
+    "allowImportingTsExtensions": true,
+    "verbatimModuleSyntax": true,
+    "moduleDetection": "force",
+    "noEmit": true,
+
+    /* Linting */
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "erasableSyntaxOnly": true,
+    "noFallthroughCasesInSwitch": true
+  },
+  "include": ["vite.config.ts"]
+}